@homeflare/alchemy 0.41.0 → 0.43.0

package/dist/proxmox/lease-cache.d.ts

@@ -47,23 +47,49 @@ import * as Cache from 'effect/Cache';
 import * as Duration from 'effect/Duration';
 import * as Effect from 'effect/Effect';
 import * as Exit from 'effect/Exit';
-import { type ApiTarget, type PveCredential, type PveRole } from './credentials.ts';
+import { type ApiTarget, type BaoEnvironment, type PveCredential, type PveRole } from './credentials.ts';
 /**
  * What a credential is cached under.
  *
- * ⛔ KEYED ON THE OPENBAO MOUNT AND ROLE, NOT ON A MEMBER HOSTNAME. A PVE API token is
- *   cluster-wide — `user.cfg` is replicated — so node-b, node-c and node-d share one credential. Keying on
- *   `api` would mint three identical tokens when failover rotates members.
+ * ⛔ KEYED ON THE OPENBAO MOUNT AND TIER, NOT ON A MEMBER HOSTNAME OR ON `role` (M3, red team on
+ *   K-T1). A PVE API token is cluster-wide — `user.cfg` is replicated — so node-b, node-c and
+ *   node-d share one credential. Keying on `api` would mint three identical tokens when failover
+ *   rotates members. `role` USED to be part of this key too, but the minted credential depends
+ *   only on `(mount, scheme, tier)` — `role` only ever fed `mintTier` to re-derive the tier the
+ *   key already carries — so `roles: { read: 'x', provision: 'x' }` (one tier for both roles, the
+ *   shape `docs/credentials.md` itself recommends) used to open TWO cache entries and mint TWO
+ *   byte-for-byte interchangeable tokens for what is provably one credential. Dropping `role`
+ *   collapses that back to one entry without changing the default case, where `tier === role`
+ *   already.
  * ★ THE MOUNT CANNOT COLLIDE ACROSS CLUSTERS: `proxmox-c1`, `proxmox-c2` and `pbs-c1` are
  *   distinct OpenBao mounts with distinct policies; two estates never share a mount name.
  * ★ A PLAIN OBJECT IS A SAFE KEY BECAUSE EFFECT COMPARES KEYS STRUCTURALLY — two separately built
  *   literals with the same fields are one entry, which the probe above measured.
+ *
+ * ⛔ `tier` IS THE KEY, NOT `role` (K-T1). `targetForKey` below has to RECONSTRUCT a target from
+ *   the key alone (it does not keep the caller's original `ApiTarget` around), and a
+ *   `PveTarget.roles` override lives on THAT original target, not on `role` — so without `tier`
+ *   in the key, every `leased()` call for an overridden role would resolve its override once at
+ *   the first `keyOf`, then reuse whatever `targetForKey` happens to reconstruct on a cache miss,
+ *   and TWO DIFFERENT overrides sharing one `{mount, scheme}` (e.g. one consumer's default `read`
+ *   tier and another's `roles: {read: 'x'}` override, same mount) would collide into ONE cache
+ *   entry and hand each other's credential to the wrong caller. Resolving the tier at `keyOf` —
+ *   where the real target is still in hand — and keying on it closes that: two different tiers
+ *   are two different entries, always.
  */
 export type LeaseKey = {
     readonly mount: string;
-    readonly role: PveRole;
     readonly scheme: ApiTarget['scheme'];
+    readonly tier: string;
 };
+/**
+ * ⚠️ EXPORTED FOR THE TEST (I1, red team on K-T1). This is the one line the whole PR exists
+ *   for — `tier: mintTier(target, role)` is what makes an overridden `PveTarget.roles` reach the
+ *   cached path at all. Nothing else in this file's test suite calls `keyOf` or `leased`
+ *   directly, so without this export a regression here (e.g. reverting to `tier: role`) passed
+ *   the whole suite silently.
+ */
+export declare const keyOf: (target: ApiTarget, role: PveRole) => LeaseKey;
 /**
  * How long a freshly minted credential may be handed out again.
  *
@@ -87,6 +113,42 @@ export declare const timeToLive: (exit: Exit.Exit<PveCredential, unknown>) => Du
  * ⚠️ EXPORTED FOR THE TEST, which hands it a counting mint instead of calling OpenBao.
  */
 export declare const makeLeases: <E, R>(mintFor: (key: LeaseKey) => Effect.Effect<PveCredential, E, R>) => Effect.Effect<Cache.Cache<LeaseKey, PveCredential, E, R>, never, never>;
+/**
+ * ⛔ CARRIES `key.tier` BACK IN AS A `roles` OVERRIDE (K-T1), SO `mint`'S OWN `mintTier` CALL
+ *   REPRODUCES THE SAME TIER `keyOf` ALREADY RESOLVED. This target is synthetic — it is never the
+ *   caller's real `PveTarget` (`members`/`api` are throwaway placeholders `mint` never reads) —
+ *   and, since M3 dropped `role` from `LeaseKey`, it no longer even knows which semantic role
+ *   produced `key.tier`. It doesn't need to: `roles: { read: key.tier }` plus always minting with
+ *   the fixed role `'read'` (below) makes `mintTier(targetForKey(key), 'read') === key.tier`
+ *   unconditionally, because `mintTier` only ever consults the ONE role it's called with. Which
+ *   role the ORIGINAL caller asked for is irrelevant here — `keyOf` already folded that into
+ *   `key.tier` before this function ever sees the key.
+ * ⚠️ THE PBS BRANCH MINTS WITH `key.tier` ITSELF AS THE ROLE, NOT `'read'`. A `PbsTarget` has no
+ *   `roles` override (see `credentials.ts`'s ⛔ on `PbsTarget`), so `mintTier` for `scheme:'pbs'`
+ *   always returns its `role` argument unchanged — meaning `key.tier` for a PBS key IS the literal
+ *   role name (`'read'`/`'provision'`) `keyOf` recorded. Passing anything else here would ask
+ *   OpenBao for the wrong tier.
+ * ⚠️ EXPORTED FOR THE TEST, which checks that round trip directly rather than only through the
+ *   cache's externally visible behaviour.
+ */
+export declare const targetForKey: (key: LeaseKey) => ApiTarget;
+/**
+ * ⚠️ EXPORTED FOR THE TEST (second red-team pass on K-T1). `targetForKey`'s own tests call
+ *   `mintTier(targetForKey(key), 'read')` to check the round trip, which hand-reproduces this
+ *   function's fixed choice of `'read'` as the pve mint role rather than exercising it — change
+ *   that choice here and those tests keep passing while a live cache miss mints the wrong tier.
+ *   Testing this function directly (against a fake OpenBao) pins the choice itself.
+ *
+ * ⚠️ `env` DEFAULTS TO `process.env`, SAME AS `mint` ITSELF (credentials.ts) — the cache's real
+ *   caller below (`Effect.runSync(makeLeases(mintForKey))`) always calls this with one argument,
+ *   so the default is what production runs on. The parameter exists only so the test can pass a
+ *   fake OpenBao's address without touching the real environment.
+ */
+export declare const mintForKey: (key: LeaseKey, env?: BaoEnvironment) => Effect.Effect<{
+    leaseSeconds: number;
+    secret: string;
+    tokenId: string;
+}, Error | import("./credential-errors.ts").PveCredentialDenied, import("effect/unstable/http/HttpClient").HttpClient>;
 /**
  * A credential for `role` on `target`: a still-valid lease when one is kept, one shared mint when
  * not.

package/dist/proxmox/lease-cache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lease-cache.d.ts","sourceRoot":"","sources":["../../src/proxmox/lease-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,EAAE,KAAK,SAAS,EAAE,KAAK,aAAa,EAAE,KAAK,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAgBpF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,QAAQ,GAAG;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;CACtC,CAAC;AAQF;;;;;;;;GAQG;AACH,eAAO,MAAM,UAAU,SAAU,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,KAAG,QAAQ,CAAC,QAG3D,CAAC;AAEpB;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,UAAU,GAAI,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,QAAQ,KAAK,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC,EAAE,CAAC,CAAC,4EACX,CAAC;AASrF;;;;;;GAMG;AACH,eAAO,MAAM,MAAM,WAAY,SAAS,QAAQ,OAAO,qJAA2C,CAAC"}
+{"version":3,"file":"lease-cache.d.ts","sourceRoot":"","sources":["../../src/proxmox/lease-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,EACL,KAAK,SAAS,EACd,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,OAAO,EAEb,MAAM,kBAAkB,CAAC;AAgB1B;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,MAAM,QAAQ,GAAG;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,KAAK,WAAY,SAAS,QAAQ,OAAO,KAAG,QAIvD,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,UAAU,SAAU,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,KAAG,QAAQ,CAAC,QAG3D,CAAC;AAEpB;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,UAAU,GAAI,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,QAAQ,KAAK,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC,EAAE,CAAC,CAAC,4EACX,CAAC;AAErF;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,YAAY,QAAS,QAAQ,KAAG,SAGoC,CAAC;AAElF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,UAAU,QAAS,QAAQ,QAAO,cAAc;;;;sHACwB,CAAC;AAItF;;;;;;GAMG;AACH,eAAO,MAAM,MAAM,WAAY,SAAS,QAAQ,OAAO,qJAA2C,CAAC"}

package/dist/proxmox/mint.d.ts

@@ -1,5 +1,5 @@
 /**
- * Minting one PVE/PBS credential from OpenBao: `GET /v1/<mount>/creds/<role>`, alive for five
+ * Minting one PVE/PBS credential from OpenBao: `GET /v1/<mount>/creds/<tier>`, alive for five
  * minutes. Split out of `credentials.ts` (2026-09-24) to keep that file's TYPES under the
  * 250-line cap once `PveCredentialDenied`'s catchers needed a real header there; the reasoning
  * for WHY the estate mints rather than stores a token is still credentials.ts's own header.
@@ -12,7 +12,9 @@ import * as HttpClient from 'effect/unstable/http/HttpClient';
 import { PveCredentialDenied } from './credential-errors.ts';
 import type { ApiTarget, BaoEnvironment, PveCredential, PveRole } from './credentials.ts';
 /**
- * Mint one credential for `role`: `GET /v1/<mount>/creds/<role>` on OpenBao's HTTP API.
+ * Mint one credential for `role`: `GET /v1/<mount>/creds/<tier>` on OpenBao's HTTP API, where
+ * `tier` is `mintTier(target, role)` (credentials.ts) — `role` itself unless `target.roles`
+ * overrides it (K-T1).
  *
  * 🔴 IT SHELLED OUT TO `bao read -format=json` UNTIL 2026-09-14. The case for the CLI was that one
  *   client could not disagree with `bao kv get` about what this machine may do. <estate>/openbao then

package/dist/proxmox/mint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mint.d.ts","sourceRoot":"","sources":["../../src/proxmox/mint.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAIxC,OAAO,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAE9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAM1F;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,IAAI,WAAY,SAAS,QAAQ,OAAO,QAAO,cAAc;;;;sDAoGtE,CAAC;AAEL;;;;;GAKG;AACH,eAAO,MAAM,aAAa,eAAgB,aAAa,UAAU,SAAS,KAAG,MAGf,CAAC"}
+{"version":3,"file":"mint.d.ts","sourceRoot":"","sources":["../../src/proxmox/mint.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAIxC,OAAO,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAE9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAE7D,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAM1F;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,IAAI,WAAY,SAAS,QAAQ,OAAO,QAAO,cAAc;;;;sDAwGtE,CAAC;AAEL;;;;;GAKG;AACH,eAAO,MAAM,aAAa,eAAgB,aAAa,UAAU,SAAS,KAAG,MAGf,CAAC"}

package/dist/proxmox/node-network.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"node-network.d.ts","sourceRoot":"","sources":["../../src/proxmox/node-network.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0EG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAI7C,OAAO,EAGL,KAAK,gBAAgB,EAGtB,MAAM,wBAAwB,CAAC;AAOhC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAEpE,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAG1D,YAAY,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAIrF,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE/D,MAAM,WAAW,kBAAmB,SAAQ,QAAQ,CAClD,qBAAqB,EACrB,gBAAgB,EAChB,qBAAqB,EACrB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,gGAAgG;AAChG,eAAO,MAAM,kBAAkB,qDAE7B,CAAC;AAiCH,eAAO,MAAM,0BAA0B,wIAuFpC,CAAC"}
+{"version":3,"file":"node-network.d.ts","sourceRoot":"","sources":["../../src/proxmox/node-network.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0EG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAI7C,OAAO,EAGL,KAAK,gBAAgB,EAGtB,MAAM,wBAAwB,CAAC;AAOhC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAGpE,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAG1D,YAAY,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAIrF,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE/D,MAAM,WAAW,kBAAmB,SAAQ,QAAQ,CAClD,qBAAqB,EACrB,gBAAgB,EAChB,qBAAqB,EACrB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,gGAAgG;AAChG,eAAO,MAAM,kBAAkB,qDAE7B,CAAC;AAiCH,eAAO,MAAM,0BAA0B,wIA4FpC,CAAC"}

package/dist/proxmox/role.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role.d.ts","sourceRoot":"","sources":["../../src/proxmox/role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAa7C,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAStE,MAAM,WAAW,SAAU,SAAQ,UAAU;IAC3C;;;;;;OAMG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;OAOG;IACH,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,4FAA4F;IAC5F,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,WAAY,SAAQ,QAAQ,CAC3C,cAAc,EACd,SAAS,EACT,cAAc,EACd,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,WAAW,8CAAwC,CAAC;AAwBjE,eAAO,MAAM,mBAAmB,iIA+E7B,CAAC"}
+{"version":3,"file":"role.d.ts","sourceRoot":"","sources":["../../src/proxmox/role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAa7C,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAUtE,MAAM,WAAW,SAAU,SAAQ,UAAU;IAC3C;;;;;;OAMG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;OAOG;IACH,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,4FAA4F;IAC5F,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,WAAY,SAAQ,QAAQ,CAC3C,cAAc,EACd,SAAS,EACT,cAAc,EACd,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,WAAW,8CAAwC,CAAC;AAwBjE,eAAO,MAAM,mBAAmB,iIAoF7B,CAAC"}

package/dist/proxmox/storage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../src/proxmox/storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsEG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAI7C,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAYtE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAExD,gGAAgG;AAChG,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,CAAC;AAElD,MAAM,WAAW,YAAa,SAAQ,UAAU;IAC9C,6FAA6F;IAC7F,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,kEAAkE;IAClE,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,wFAAwF;IACxF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,uEAAuE;IACvE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+FAA+F;IAC/F,QAAQ,CAAC,EAAE,KAAK,CAAC;CAClB;AAED,MAAM,WAAW,cAAe,SAAQ,QAAQ,CAC9C,iBAAiB,EACjB,YAAY,EACZ,iBAAiB,EACjB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,qGAAqG;AACrG,eAAO,MAAM,cAAc,iDAEzB,CAAC;AAEH,eAAO,MAAM,sBAAsB,oIAuGhC,CAAC"}
+{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../src/proxmox/storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsEG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAI7C,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAatE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAExD,gGAAgG;AAChG,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,CAAC;AAElD,MAAM,WAAW,YAAa,SAAQ,UAAU;IAC9C,6FAA6F;IAC7F,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,kEAAkE;IAClE,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,wFAAwF;IACxF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,uEAAuE;IACvE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+FAA+F;IAC/F,QAAQ,CAAC,EAAE,KAAK,CAAC;CAClB;AAED,MAAM,WAAW,cAAe,SAAQ,QAAQ,CAC9C,iBAAiB,EACjB,YAAY,EACZ,iBAAiB,EACjB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,qGAAqG;AACrG,eAAO,MAAM,cAAc,iDAEzB,CAAC;AAEH,eAAO,MAAM,sBAAsB,oIA4GhC,CAAC"}

package/dist/proxmox/unreadable-read.d.ts

@@ -45,6 +45,13 @@ export declare const readOrUnreadable: <A, E, R>(effect: Effect.Effect<A, E | Pv
  * in `bun run plan`'s own output (Effect's default logger), even though the Diff type has
  * nowhere to carry the distinction through to the printed action. See the header for why a log
  * line, not a failed diff or a fourth Diff action, is what "the plan reports" means here.
+ *
+ * ⛔ M6 (Opus red team, K-T1): NAMES `mount` AND `tier`, NOT JUST THE RESOURCE. Before this, the
+ *   line read "no grant for this credential's role" with nothing to act on — an operator debugging
+ *   a scoped-down `PveTarget.roles` override (the whole point of K-T1) had to go re-derive which
+ *   mount and tier the read actually asked OpenBao for before they could even open that mount's
+ *   policy. `PveCredentialDenied`'s own message already made this exact call — reading `tier`, not
+ *   `role`, per that class's own ⛔ — so this warning takes the same two fields for the same reason.
  */
-export declare const unreadableWarning: (type: string, identity: string) => Effect.Effect<void>;
+export declare const unreadableWarning: (type: string, identity: string, mount: string, tier: string) => Effect.Effect<void>;
 //# sourceMappingURL=unreadable-read.d.ts.map

package/dist/proxmox/unreadable-read.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"unreadable-read.d.ts","sourceRoot":"","sources":["../../src/proxmox/unreadable-read.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAElE,sFAAsF;AACtF,eAAO,MAAM,UAAU,eAA2B,CAAC;AACnD,MAAM,MAAM,UAAU,GAAG,OAAO,UAAU,CAAC;AAE3C;;;;;;;;;;GAUG;AACH,eAAO,MAAM,gBAAgB,GAAI,CAAC,EAAE,CAAC,EAAE,CAAC,UAC9B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,mBAAmB,EAAE,CAAC,CAAC,KACnD,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,UAAU,EAAE,CAAC,EAAE,CAAC,CACkD,CAAC;AAExF;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,SAAU,MAAM,YAAY,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAKlF,CAAC"}
+{"version":3,"file":"unreadable-read.d.ts","sourceRoot":"","sources":["../../src/proxmox/unreadable-read.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAElE,sFAAsF;AACtF,eAAO,MAAM,UAAU,eAA2B,CAAC;AACnD,MAAM,MAAM,UAAU,GAAG,OAAO,UAAU,CAAC;AAE3C;;;;;;;;;;GAUG;AACH,eAAO,MAAM,gBAAgB,GAAI,CAAC,EAAE,CAAC,EAAE,CAAC,UAC9B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,mBAAmB,EAAE,CAAC,CAAC,KACnD,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,UAAU,EAAE,CAAC,EAAE,CAAC,CACkD,CAAC;AAExF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,iBAAiB,SACtB,MAAM,YACF,MAAM,SACT,MAAM,QACP,MAAM,KACX,MAAM,CAAC,MAAM,CAAC,IAAI,CAKlB,CAAC"}

package/dist/proxmox/user.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user.d.ts","sourceRoot":"","sources":["../../src/proxmox/user.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAI7C,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AActE,MAAM,WAAW,SAAU,SAAQ,UAAU;IAC3C;;;;;;;OAOG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,iCAAiC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mGAAmG;IACnG,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,kFAAkF;IAClF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2FAA2F;IAC3F,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,qFAAqF;IACrF,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,WAAY,SAAQ,QAAQ,CAC3C,cAAc,EACd,SAAS,EACT,cAAc,EACd,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,WAAW,8CAAwC,CAAC;AAEjE,eAAO,MAAM,mBAAmB,iIAgG7B,CAAC"}
+{"version":3,"file":"user.d.ts","sourceRoot":"","sources":["../../src/proxmox/user.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAI7C,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAetE,MAAM,WAAW,SAAU,SAAQ,UAAU;IAC3C;;;;;;;OAOG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,iCAAiC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mGAAmG;IACnG,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,kFAAkF;IAClF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2FAA2F;IAC3F,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,qFAAqF;IACrF,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,WAAY,SAAQ,QAAQ,CAC3C,cAAc,EACd,SAAS,EACT,cAAc,EACd,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,eAAO,MAAM,WAAW,8CAAwC,CAAC;AAEjE,eAAO,MAAM,mBAAmB,iIAqG7B,CAAC"}

package/dist/proxmox/zfs-pool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"zfs-pool.d.ts","sourceRoot":"","sources":["../../src/proxmox/zfs-pool.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwEG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAI7C,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGtE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE5D,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvE,YAAY,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,YAAY,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvE;;;;;;;;GAQG;AACH,MAAM,WAAW,YAAa,SAAQ,UAAU;IAC9C;;;;;OAKG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,+FAA+F;IAC/F,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,SAAS,CAAC,EAAE,YAAY,CAAC;IACzB;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,WAAW,CAAC,EAAE,cAAc,CAAC;IAC7B;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,cAAe,SAAQ,QAAQ,CAC9C,iBAAiB,EACjB,YAAY,EACZ,iBAAiB,EACjB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,mGAAmG;AACnG,eAAO,MAAM,cAAc,iDAEzB,CAAC;AAEH,eAAO,MAAM,sBAAsB,oIAyEhC,CAAC"}
+{"version":3,"file":"zfs-pool.d.ts","sourceRoot":"","sources":["../../src/proxmox/zfs-pool.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwEG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAI7C,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAItE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE5D,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvE,YAAY,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,YAAY,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvE;;;;;;;;GAQG;AACH,MAAM,WAAW,YAAa,SAAQ,UAAU;IAC9C;;;;;OAKG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,+FAA+F;IAC/F,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,SAAS,CAAC,EAAE,YAAY,CAAC;IACzB;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,WAAW,CAAC,EAAE,cAAc,CAAC;IAC7B;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,cAAe,SAAQ,QAAQ,CAC9C,iBAAiB,EACjB,YAAY,EACZ,iBAAiB,EACjB,KAAK,EACL,eAAe,CAChB;CAAG;AAEJ,mGAAmG;AACnG,eAAO,MAAM,cAAc,iDAEzB,CAAC;AAEH,eAAO,MAAM,sBAAsB,oIA8EhC,CAAC"}

package/docs/credentials.md

@@ -12,7 +12,20 @@ a denied grant rather than a missing file, and `Bearer ` + nothing 401s in a way
 like a bad credential.
 
 The Proxmox subpath mints every call's token from an OpenBao mount instead; see
-[proxmox.md](./proxmox.md).
+[proxmox.md](./proxmox.md). Every call still asks for one of two semantic roles, `read` or
+`provision` (`PveRole`, `credentials.ts`) — a `PveTarget` can optionally override which OpenBao
+mint TIER NAME each one actually resolves to (`roles: { read?, provision? }`, K-T1, 2026-09-27):
+one consumer with its own least-privilege tier for both roles on the SAME mount sets
+`roles: { read: 'my-tier', provision: 'my-tier' }` and every call this package already makes
+mints that tier instead, with no new call site anywhere in the package. `credentials.ts`'s
+`mintTier` is the one place that resolution happens; `mint.ts` and `lease-cache.ts` both call it
+rather than reading `role`/`target.roles` directly — see `mintTier`'s own header for why the
+lease cache specifically needed it too, not just the mint call.
+
+⛔ **Override both roles or neither.** An unmentioned role is not scoped down — it still mints
+the estate-wide `read`/`provision` tier. Setting only `roles: { read: 'my-tier' }` leaves every
+reconcile/delete on that target minting the full-privilege `provision` credential while the plan
+output looks entirely scoped down.
 
 The Forgejo subpath (2026-09-23, moved onto `@distilled.cloud/forgejo`) resolves credentials
 through the package's own `CredentialsFromEnv` layer, which reads `FORGEJO_URL` / `FORGEJO_TOKEN`

package/docs/litellm-budget.md

@@ -0,0 +1,55 @@
+# LiteLLM — `LiteLLM.Budget`
+
+One row of LiteLLM's `LiteLLM_BudgetTable` (`/budget/*`): the "tier" that virtual keys and teams
+bind to (`hf-tier-agent`, `hf-tier-interactive`, …). Typed calls come from
+`@distilled.cloud/litellm/budget_management`; credentials and refusals are the family's, see
+[litellm.md](./litellm.md).
+
+## Monitoring, not limits
+
+`max_budget` is a **hard cap**: LiteLLM's own field doc says "Requests will fail if this budget
+(in USD) is exceeded". On 2026-09-28 an undeclared $60/day cap on `hf-tier-interactive` (made
+through the API on 09-06, in no repo) 429'd every call of the claude2 fleet. So:
+
+- `softBudget` is the prop to reach for: it "will NOT fail if this is exceeded" and fires the alert.
+- `maxBudget` is **never defaulted**, and the plan is refused
+  (`LitellmBudgetHardCapUnjustifiedError`) unless `maxBudgetReason` is set. The reason lives in the
+  declaration, so a hard cap is a reviewed line of source, not an API side effect.
+
+```ts
+export class Interactive extends LiteLLMBudget('Interactive', {
+  budgetId: 'hf-tier-interactive', // adopts the live row (needs --adopt)
+  budgetDuration: '1d',
+  softBudget: 60,
+  rpmLimit: 60,
+  tpmLimit: 6_000_000,
+}) {}
+```
+
+Declaring an adopted hard tier **without** `maxBudget` clears the live cap: the update sends an
+explicit `null` for every limit the declaration omits.
+
+## Behaviour
+
+| Concern     | Rule                                                                                                                                                        |
+| ----------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Identity    | `budgetId` (else a deterministic physical name). A different declared id is a `replace`.                                                                    |
+| Adopt       | A live row with the id and no state is `Unowned`; needs `--adopt`.                                                                                          |
+| Removal     | `defaultRemovalPolicy: 'retain'`. Opt in with `RemovalPolicy.destroy()`. Delete is idempotent: a `BadRequest` is swallowed only if a re-list shows it gone. |
+| Read        | `/budget/list` (whole table). `rpm_limit`/`tpm_limit` come back as decimal strings (`BigInt?`), converted to numbers.                                       |
+| Write check | Reconcile reads back; a limit the row still carries that the declaration dropped fails with `LitellmBudgetFieldNotClearedError`.                            |
+
+## Version: distilled copy is 1.100.0, the proxy is 1.103.0
+
+The SDK is generated at v1.100.0. For the budget routes the request bodies used here
+(`budget_id`, `soft_budget`, `max_budget`, `budget_duration`, `rpm_limit`, `tpm_limit`) are all in
+that schema. **Not measured against 1.103.0** (no live proxy read was made, and the source for it
+is not cloned): whether `/budget/update` accepts an explicit `null` to clear a limit, and what
+happens on create of an existing id. The fake models 400 for both. The read-back check above
+exists so an `exclude_none` merge fails loudly instead of leaving a hard cap in place.
+
+## Not modelled
+
+`max_parallel_requests`, `model_max_budget` and `budget_reset_at`: the row read back
+(`BudgetListItem`) does not carry them, so a declaration could never be diffed. Add them once a
+read that returns them is measured. Keys and teams that reference a tier are separate resources.

package/docs/litellm.md

@@ -16,12 +16,13 @@ against the tag's committed `schema.d.ts`; NOT a live read, because the referenc
 Measured at 1.100.0 (`schema.prisma`, `pass_through_endpoints.py`, and the mini's own
 `settings.yaml` `store_model_in_db: true`):
 
-| Family                                                                                                  | Managed by this resource?                       |
-| ------------------------------------------------------------------------------------------------------- | ----------------------------------------------- |
-| Pass-through endpoints                                                                                  | Yes — this package                              |
-| Models, virtual keys, teams, credentials, access groups                                                 | DB-backed, API-managed, but no kit resource yet |
-| `router_settings`, `litellm_settings`, `general_settings.master_key`/`database_url`/`store_model_in_db` | config-file only — read-only through the API    |
-| A `config.yaml` pass-through entry (`is_from_config: true`)                                             | Read-only through this resource — see Refusals  |
+| Family                                                                                                  | Managed by this resource?                                        |
+| ------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------- |
+| Pass-through endpoints                                                                                  | Yes — this package                                               |
+| Budgets (`/budget/*`)                                                                                   | Yes — `LiteLLM.Budget`, [litellm-budget.md](./litellm-budget.md) |
+| Models, virtual keys, teams, credentials, access groups                                                 | DB-backed, API-managed, but no kit resource yet                  |
+| `router_settings`, `litellm_settings`, `general_settings.master_key`/`database_url`/`store_model_in_db` | config-file only — read-only through the API                     |
+| A `config.yaml` pass-through entry (`is_from_config: true`)                                             | Read-only through this resource — see Refusals                   |
 
 ## Credentials
 

package/docs/postgres.md

@@ -123,3 +123,25 @@ mini's 19 already-live databases needs `adopt(true)` in the consuming stack.
 
 Whether `ALTER DATABASE … REFRESH COLLATION VERSION` should ever be offered as an explicit,
 separate operation (not part of `reconcile`) is open — nothing in this family calls it.
+
+## Runner transport (loopback-only clusters)
+
+A cluster reachable only by a command — CT100's rootful podman container `postgres`, loopback
+listener, local socket, user `postgres`, no password — cannot take a wire connection from the
+mini. `postgresRunnerProviders({ run, database, username, template? })` (or
+`postgresRunnerConnection` on its own) runs the same `Postgres.Database` reconcile through a
+caller-supplied `PsqlRunner`, which prepends the transport, e.g. `ssh <host> sudo -n podman
+exec -i postgres <argv>` with `stdin` piped through. The kit holds no host, container or sudo
+rule; the consuming stack's runner does.
+
+- Same props, same create-and-assert, same adopt/retain and drift semantics — only the
+  `PgExecutor` differs (`psql-executor.ts`).
+- `psql` has no bind parameters, so string params are inlined as `quoteStringLiteral`
+  literals; a non-string param is refused. Rows come back through `json_agg`, so `oid` and
+  `datconnlimit` are numbers as on the socket path.
+- `CREATE DATABASE … TEMPLATE "template0"` is the runner default (`template` overrides):
+  CT100's `template1` is ParadeDB's and would copy postgis/pg_ivm/paradedb objects. The socket
+  path adds no `TEMPLATE` clause, unchanged.
+- Not covered: there is no `Postgres.Role` resource in the kit yet, so the owner role must
+  exist (`PostgresDatabaseOwnerMissing` otherwise). NetBox's 11 lost triggers on `pg_restore`
+  are a restore concern, out of this resource's scope.

package/docs/proxmox-sdk-migration.md

@@ -44,6 +44,51 @@ SdnVnet, SdnSubnet, HaResource, HaRule and CephFlag.
 Their previous measured-none records
 are historical inventories, not a current census or permission to skip migration.
 
+**Measured 2026-09-28, by parser** (Bun's `Transpiler.scanImports` — a real import-graph
+read, not a text match — walked one hop through local imports so a family that only
+reaches the hand client via the shared `resource.ts` factory is still attributed
+correctly; run against `packages/alchemy/src/proxmox` and `src/openbao`):
+
+| Package                           | distilled-only | hand-client-only                                                                                                                                                                                | mixed                                                                                                    | no transport import (pure logic/form/test) |
+| --------------------------------- | -------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------- | ------------------------------------------ |
+| `alchemy/src/proxmox` (165 files) | 71             | 9 — `resource.ts` (the shared `pveHandlers` factory itself), `sdn-zone.ts`, `sdn-vnet.ts`, `sdn-subnet.ts`, `sdn-apply.ts`, `sdn-apply-read.ts`, `ha-resource.ts`, `ha-rule.ts`, `ceph-flag.ts` | 1 — `index.ts` (barrel, re-exports both)                                                                 | 84                                         |
+| `alchemy/src/openbao` (80 files)  | 2              | 36 (every `Bao*` family but Policy)                                                                                                                                                             | 5 — `distilled.ts`, `policy-wire.ts`, `policy-identity.ts`, `auth-role-wire.ts`, `auth-role-identity.ts` | 37                                         |
+
+The proxmox count confirms the doc text above with one addition: nine, not eight,
+files are hand-client-only. Eight back the seven named families (SdnApply's family
+spans two files, `sdn-apply.ts` and `sdn-apply-read.ts`); the ninth is `resource.ts`
+— the shared `pveHandlers`/`pveOperations` factory itself, which imports
+`./client.ts` and no `@distilled.cloud/*` module, so
+the one-hop rule that correctly attributes the seven named families' hand-client use
+attributes this file's own import the same way. It does not mean every distilled-only
+family still calls through it: 17 of the 71 import `resource.ts`, and all 17 are
+type-only (`PveRequirements`/`WithTarget`, or `WithPbsTarget` for three PBS files —
+types are erased at build time, invisible to `scanImports`, so the parser correctly
+leaves them out of this table). `ceph-osd.ts` is one of those 17, not an exception;
+it is the only one of the 71 that even mentions `pveHandlers` at all, in a comment
+explaining why it deliberately does not use the factory — read in full, it calls
+neither factory function. No other PVE/PBS family has regressed to hand-client
+since the 28-family migration
+landed.
+
+**OpenBao is far less migrated than this repo's own comments could suggest** — only
+`BaoPolicy`'s wire/identity pair and the `distilled.ts` wrapper use distilled transport
+at all today; every other family (`BaoMount`, `BaoAuthMethod`, `BaoAuthRole`'s form
+paths, `BaoPkiRole`, `BaoSshRole`, `BaoCloudflareRole`, `BaoProxmoxRole`, `BaoJwtRole`,
+`BaoJwtAuthConfig`, `BaoMfaTotpMethod`, `BaoMfaLoginEnforcement`, `BaoPlugin`,
+rename/remount/role-reconcile helpers) is still on the hand `bao-http.ts` client.
+`mount-wire.ts` specifically is blocked on more than volume: the distilled SDK's
+`mounts.ts` operations all declare `errors: []` (no typed absence error), unlike the
+sibling `policies.ts`'s `PolicyNotFound` — a clean migration needs that SDK gap patched
+first, in the distilled clone, per [the interim route](./distilled-interim.md)'s
+build-SDK-first step. Two `codex/`-prefixed worktrees already exist in the distilled
+clone (`openbao-mount-map`, `openbao-policy-runtime`) with unmerged work toward exactly
+this: `openbao-mount-map`'s six commits generate the OpenBao SDK from a disposable local
+2.6.2 server and add a typed mount-inventory response shape (`protocol-mount-tables.ts`,
+provenance in `patches/mount-tables.md`), but its `mounts.ts` operations still declare
+`errors: []` — the inventory-shape fix and the typed-absence-error fix are two separate
+gaps, and only the first is done there.
+
 - NetworkApply reads `listNodeNetwork`. A string `changes` sibling is preserved by
   the protocol and decoded by that operation's union. The diff is counted and does
   not enter state or logs.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@homeflare/alchemy",
-  "version": "0.41.0",
+  "version": "0.43.0",
   "description": "Custom Alchemy providers for Cloudflare, Proxmox, OpenBao, Forgejo, Talos, launchd and Caddy, and a verifier that proves adoptions are no-ops.",
   "homepage": "https://github.com/taslabs-net/homeflare-kit/tree/main/packages/alchemy#readme",
   "bugs": "https://github.com/taslabs-net/homeflare-kit/issues",
@@ -128,12 +128,12 @@
   "dependencies": {
     "@distilled.cloud/caddy": "npm:@homeflare/distilled-caddy@0.2.2",
     "@distilled.cloud/grafana": "npm:@homeflare/distilled-grafana@0.2.0",
-    "@distilled.cloud/litellm": "npm:@homeflare/distilled-litellm@0.2.0",
+    "@distilled.cloud/litellm": "npm:@homeflare/distilled-litellm@0.3.0",
     "@distilled.cloud/netbox": "npm:@homeflare/distilled-netbox@0.3.0",
     "@distilled.cloud/openbao": "npm:@homeflare/distilled-openbao@0.2.2",
     "@distilled.cloud/opnsense": "npm:@homeflare/distilled-opnsense@0.3.0",
     "@distilled.cloud/paperless-ngx": "npm:@homeflare/distilled-paperless-ngx@0.3.0",
-    "@distilled.cloud/proxmox": "npm:@homeflare/distilled-proxmox@0.3.3",
+    "@distilled.cloud/proxmox": "npm:@homeflare/distilled-proxmox@0.3.4",
     "@distilled.cloud/proxmox-backup": "npm:@homeflare/distilled-proxmox-backup@0.3.1",
     "@distilled.cloud/unifi-network": "npm:@homeflare/distilled-unifi-network@0.4.0"
   },

package/src/litellm/budget-errors.ts

@@ -0,0 +1,38 @@
+/**
+ * The typed refusals `LiteLLM.Budget` raises on top of `@distilled.cloud/litellm`'s own SDK errors.
+ */
+import type * as budgets from '@distilled.cloud/litellm/budget_management';
+import * as Data from 'effect/Data';
+
+/** A `maxBudget` (a HARD cap: LiteLLM answers 429 once it is spent) declared with no reason. */
+export class LitellmBudgetHardCapUnjustifiedError extends Data.TaggedError(
+  'LitellmBudgetHardCapUnjustifiedError',
+)<{
+  readonly budgetId: string | undefined;
+}> {}
+
+/**
+ * The write returned no error but the row still carries a limit the declaration does not.
+ * `/budget/update` may merge with `exclude_none` (the way `/config/pass_through_endpoint` does),
+ * in which case a limit can never be cleared by an update. Refused, never claimed as done.
+ */
+export class LitellmBudgetFieldNotClearedError extends Data.TaggedError(
+  'LitellmBudgetFieldNotClearedError',
+)<{
+  readonly budgetId: string;
+  readonly fields: readonly string[];
+}> {}
+
+/** `/budget/info` answered something that is not a list of budget rows. */
+export class LitellmBudgetUnreadableError extends Data.TaggedError('LitellmBudgetUnreadableError')<{
+  readonly budgetId: string;
+}> {}
+
+export type BudgetError =
+  | budgets.PostInfoBudgetBudgetInfoError
+  | budgets.PostNewBudgetBudgetNewError
+  | budgets.UpdateBudgetBudgetUpdatePostError
+  | budgets.DeleteBudgetBudgetDeletePostError
+  | LitellmBudgetHardCapUnjustifiedError
+  | LitellmBudgetFieldNotClearedError
+  | LitellmBudgetUnreadableError;

package/src/litellm/budget-form.ts

@@ -0,0 +1,94 @@
+/**
+ * Props, wire bodies and comparison for `LiteLLM.Budget`, testable without a server.
+ *
+ * ⛔ NO SILENT `max_budget`. LiteLLM's own field doc: "Requests will fail if this budget (in USD)
+ *   is exceeded" — a hard cap. On 2026-09-28 an undeclared $60/day `max_budget` on
+ *   `hf-tier-interactive` 429'd the whole claude2 fleet. So `maxBudget` is never defaulted and is
+ *   refused unless `maxBudgetReason` says why; `softBudget` is the monitoring field (it "will NOT
+ *   fail if this is exceeded", it fires the alert).
+ * ⚠️ NOT MODELLED: `max_parallel_requests`, `model_max_budget`, `budget_reset_at`. The row read
+ *   back (`BudgetListItem`, generated at LiteLLM 1.100.0) has none of them, so a declaration of
+ *   them could never be diffed. Add them when a read that returns them is measured.
+ */
+import type * as budgets from '@distilled.cloud/litellm/budget_management';
+
+export interface BudgetProps {
+  /** Live budget id. Set it to adopt an existing row (`hf-tier-agent`); default is a deterministic physical name. */
+  readonly budgetId?: string;
+  /** Alert threshold in USD. Requests keep flowing when exceeded. The monitoring field. */
+  readonly softBudget?: number;
+  /** HARD cap in USD: requests fail (429) once spent. Refused unless `maxBudgetReason` is set. */
+  readonly maxBudget?: number;
+  /** Why a hard cap is wanted. Required with `maxBudget`; recorded in the declaration only. */
+  readonly maxBudgetReason?: string;
+  /** Reset period, e.g. `'1d'`, `'28d'`. */
+  readonly budgetDuration?: string;
+  /** Requests per minute. */
+  readonly rpmLimit?: number;
+  /** Tokens per minute. */
+  readonly tpmLimit?: number;
+}
+
+export interface BudgetAttributes {
+  readonly budgetId: string;
+  readonly softBudget: number | null;
+  readonly maxBudget: number | null;
+  readonly budgetDuration: string | null;
+  readonly rpmLimit: number | null;
+  readonly tpmLimit: number | null;
+}
+
+/** Declared field → wire field. The single list every comparison and body walks. */
+const FIELDS = [
+  ['softBudget', 'soft_budget'],
+  ['maxBudget', 'max_budget'],
+  ['budgetDuration', 'budget_duration'],
+  ['rpmLimit', 'rpm_limit'],
+  ['tpmLimit', 'tpm_limit'],
+] as const;
+
+export const isHardCapUnjustified = (props: BudgetProps): boolean =>
+  props.maxBudget !== undefined && (props.maxBudgetReason ?? '').trim() === '';
+
+/** Create body: only what is declared. */
+export const createBody = (
+  props: BudgetProps,
+  budgetId: string,
+): budgets.PostNewBudgetBudgetNewRequest => {
+  const body: Record<string, unknown> = { budget_id: budgetId };
+  for (const [prop, wire] of FIELDS) if (props[prop] !== undefined) body[wire] = props[prop];
+  return body as budgets.PostNewBudgetBudgetNewRequest;
+};
+
+/** Update body: declared fields, plus an explicit `null` for a live limit the declaration dropped. */
+export const updateBody = (
+  props: BudgetProps,
+  live: BudgetAttributes,
+): budgets.UpdateBudgetBudgetUpdatePostRequest => {
+  const body: Record<string, unknown> = { budget_id: live.budgetId };
+  for (const [prop, wire] of FIELDS) {
+    if (props[prop] !== undefined) body[wire] = props[prop];
+    else if (live[prop] !== null) body[wire] = null;
+  }
+  return body as budgets.UpdateBudgetBudgetUpdatePostRequest;
+};
+
+/** Wire names of the fields where live and declared disagree. */
+export const differing = (live: BudgetAttributes, props: BudgetProps): readonly string[] =>
+  FIELDS.filter(([prop]) => live[prop] !== (props[prop] ?? null)).map(([, wire]) => wire);
+
+const numberOrNull = (value: unknown): number | null =>
+  value === null || value === undefined || value === '' ? null : Number(value);
+
+/**
+ * One row of `/budget/info`. `tpm_limit`/`rpm_limit` are `BigInt?` in LiteLLM's schema and come
+ * back as decimal strings (the generated `BudgetListItem` says so), hence `Number()`.
+ */
+export const toAttributes = (row: Record<string, unknown>): BudgetAttributes => ({
+  budgetDuration: typeof row['budget_duration'] === 'string' ? row['budget_duration'] : null,
+  budgetId: String(row['budget_id']),
+  maxBudget: numberOrNull(row['max_budget']),
+  rpmLimit: numberOrNull(row['rpm_limit']),
+  softBudget: numberOrNull(row['soft_budget']),
+  tpmLimit: numberOrNull(row['tpm_limit']),
+});

package/src/litellm/budget-operations.ts

@@ -0,0 +1,51 @@
+/**
+ * The four LiteLLM `/budget/*` calls `LiteLLM.Budget` uses, through the SDK's typed operations.
+ *
+ * ★ READS GO THROUGH `/budget/list` (the whole table, a bare array), not `/budget/info`. Both
+ *   answer `body: unknown` in the generated schema, and what `/budget/info` does for an id that is
+ *   not there is unmeasured; a list answers absence unambiguously.
+ * ⚠️ Unlike pass-through endpoints, each budget is its own DB row, so no semaphore.
+ * ⚠️ DELETE is idempotent BY THIS FUNCTION: a `BadRequest` re-lists and is swallowed only when the
+ *   id is genuinely absent, never on message text (pass-through `operations.ts`' rule).
+ */
+import * as budgets from '@distilled.cloud/litellm/budget_management';
+import * as Effect from 'effect/Effect';
+import { type LitellmOpContext, throughFetch } from './operations.ts';
+import { type BudgetAttributes, toAttributes } from './budget-form.ts';
+import { LitellmBudgetUnreadableError } from './budget-errors.ts';
+
+export const listBudgets = (): Effect.Effect<
+  readonly BudgetAttributes[],
+  budgets.ListBudgetBudgetListGetError | LitellmBudgetUnreadableError,
+  LitellmOpContext
+> =>
+  throughFetch(budgets.listBudgetBudgetListGet({})).pipe(
+    // ⚠️ MEASURED with the fake: the SDK types this `{ body: unknown }` but hands a bare JSON array
+    //   back as the array itself, so accept both shapes and refuse anything else.
+    Effect.flatMap((response) => {
+      const rows: unknown = Array.isArray(response)
+        ? response
+        : (response as { body?: unknown }).body;
+      return Array.isArray(rows)
+        ? Effect.succeed(rows.map((row) => toAttributes(row as Record<string, unknown>)))
+        : Effect.fail(new LitellmBudgetUnreadableError({ budgetId: '*' }));
+    }),
+  );
+
+export const createBudget = (body: budgets.PostNewBudgetBudgetNewRequest) =>
+  throughFetch(budgets.postNewBudgetBudgetNew(body)).pipe(Effect.asVoid);
+
+export const updateBudget = (body: budgets.UpdateBudgetBudgetUpdatePostRequest) =>
+  throughFetch(budgets.updateBudgetBudgetUpdatePost(body)).pipe(Effect.asVoid);
+
+export const deleteBudget = (id: string) =>
+  throughFetch(budgets.deleteBudgetBudgetDeletePost({ id })).pipe(
+    Effect.asVoid,
+    Effect.catchTag('BadRequest', (original) =>
+      listBudgets().pipe(
+        Effect.flatMap((rows) =>
+          rows.some((row) => row.budgetId === id) ? Effect.fail(original) : Effect.void,
+        ),
+      ),
+    ),
+  );